IBM QRadar Security Intelligence Version Offboard Storage Guide IBM

Transcription

1 IBM QRadar Security Intelligence Version Offboard Storage Guide IBM

2 Note Before you use this information and the product that it supports, read the information in Notices on page 33. Product information This document applies to IBM QRadar Security Intelligence Platform V7.3.1 and subsequent releases unless superseded by an updated ersion of this document. Copyright IBM Corporation 2012, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Introduction to offboard storage deices for QRadar products Offboard storage oeriew Appliance storage requirements for irtual and software installations File system options for offboard storage Performance impact of offboard storage solutions Storage expansion External storage options External storage limitations Offboard storage in HA enironments iscsi external storage deice Configuring the iscsi olumes Moing the /store file system to an iscsi storage solution Moing the /store/ariel file system to an iscsi storage solution Mounting the iscsi olume automatically Configuring iscsi in an HA deployment Verifying iscsi connections Troubleshooting iscsi issues Upgrading an HA deployment with an offboard iscsi /store partition Upgrading an HA deployment with an offboard iscsi /store/ariel partition Secondary network interfaces Configuring control of secondary interfaces in HA deployments Fibre Channel storage Verifying your Emulex adapter installation Verifying the Fibre Channel connections Moing the /store file system to a Fibre Channel solution Moing the /store/ariel file system to a Fibre Channel solution Moing the /store file system to a multipath Fibre Channel solution Moing the /store file system to a multipath Fibre Channel solution in an HA deployment Configuring the mount point for the secondary HA host Upgrading an HA deployment with an offboard Fibre Channel /store partition Upgrading an HA deployment with an offboard Fibre Channel /store/ariel partition NFS offboard storage deice Moing backups to an NFS Configuring NFS backup on an existing HA cluster Configuring a mount point for a secondary HA host Upgrading an HA deployment with an NFS /store/backup olume Notices Trademarks Terms and conditions for product documentation IBM Online Priacy Statement General Data Protection Regulation Copyright IBM Corp. 2012, 2017 iii

4 i IBM QRadar Security Intelligence: Offboard Storage Guide

5 Introduction to offboard storage deices for QRadar products This guide proides information about how to moe the /store, /store/backup, or /store/ariel file systems to an external storage deice for IBM Security QRadar products. Intended audience System administrators responsible for configuring offboard storage deices must hae administratie access to QRadar systems and to network deices and firewalls. The system administrator must know the corporate network and networking technologies. Technical documentation To find IBM Security QRadar product documentation on the web, including all translated documentation, access the IBM Knowledge Center ( For information about how to access more technical documentation in the QRadar products library, see Accessing IBM Security Documentation Technical Note ( &uid=swg ). Contacting customer support For information about contacting customer support, see the Support and Download Technical Note ( Statement of good security practices IT system security inoles protecting systems and information through preention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, serice or security measure can be completely effectie in preenting improper use or access. IBM systems, products and serices are designed to be part of a lawful comprehensie security approach, which will necessarily inole additional operational procedures, and may require other systems, products or serices to be most effectie. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Please Note: Use of this Program may implicate arious laws or regulations, including those related to priacy, data protection, employment, and electronic communications and storage. IBM Security QRadar may be used only for lawful purposes and in a lawful manner. Customer agrees to use this Program pursuant to, and assumes all responsibility for complying with, applicable laws, regulations and policies. Licensee represents that it will obtain or has obtained any consents, permissions, or licenses required to enable its lawful use of IBM Security QRadar. Copyright IBM Corp. 2012, 2017

6 i IBM QRadar Security Intelligence: Offboard Storage Guide

7 1 Offboard storage oeriew To increase the amount of storage space aailable to your appliance, you can moe a portion your data to an offboard storage deice. You can moe your /store, /store/ariel, or /store/backup file systems. Multiple methods are aailable for adding external storage, including iscsi, Fibre Channel, and NFS (Network File System). You must use iscsi or Fibre Channel to store data that is accessible and searchable, such as the /store/ariel directory. Important: NFS can be used only for daily backup data, such as the /store/backup/ directory. Note: If you use NFS or a Windows share for offboard storage, your system can lock and cause an outage. This practice is not supported by IBM Security QRadar. You can use offboard storage solutions on any managed host or console, including high-aailability (HA) systems. When you use iscsi or Fibre Channel with HA, the external storage deice is mounted by the actie HA node, ensuring data consistency for an HA failure. When you use external storage with HA, you must configure these deices on the primary and secondary HA hosts. Before you implement an offboard storage solution, consider your local storage options, existing hardware infrastructure, and your data retention and fault tolerance requirements. Local storage Data that is stored locally on a QRadar appliance can be accessed with lower latency than on external storage and supports up to 40 TB of data. When possible, use local storage and Data Node appliances as an alternatie to an external storage deice. Multiple appliances Use multiple appliances if larger storage capacity is required for your QRadar deployment. When multiple appliances are not feasible, or when an existing deployment can increase capacity by using aailable external storage, then external storage might be appropriate for your deployment. Hardware and infrastructure Your existing infrastructure and experience with storage area networks are important factors in deciding whether to use an offboard storage solution. Certain offboard deices require less configuration and might be able to use existing network infrastructures. For example, iscsi uses existing Ethernet networking, while Fibre Channel uses specialized hardware. Data retention and fault tolerance Your QRadar data retention policy is important in considering an offboard storage solution. If your data retention settings exceed the capacity of existing storage or if you are planning to expand the retention of existing deployed appliances, you might require an offboard storage solution. An offboard storage solution can be used to improe your fault tolerance and disaster recoery capabilities. Copyright IBM Corp. 2012,

8 Appliance storage requirements for irtual and software installations To install QRadar using irtual or software options the deice must meet minimum storage requirements. The following table shows the recommenced minimum storage requirements for installing QRadar by using the irtual or software only option. Note: The minimum required storage size will ary, based on factors such as eent size, eents per second (EPS), and retention requirements. Table 1. Minimum storage requirements for appliances when you use the irtual or software installation option. System classification Appliance information IOPS Minimum performance Supports XX05 licensing Medium performance Supports XX28 licensing High Performance Supports XX48 licensing 10, Small All-in-One or 1600 Less than 500 EPS Eent/Flow Collectors Eents and flows Data transfer rate (MB/s) File system options for offboard storage Use an offboard storage solution to moe the /store file system or specific subdirectories, such as the /store/ariel directory. You can moe the /store file system to increase the fault tolerance leels in your IBM Security QRadar deployment. Each option impacts QRadar performance. The /store/ariel directory is the most common file system that is moed to an offboard storage solution. By moing the /store/ariel file system, you can moe collected log and network actiity data to external storage. The local disk remains used for the PostgreSQL database and for temporary search results. Administrators can moe the following types of QRadar data to offboard storage deices: PostgreSQL metadata and configuration information Log actiity, payloads (raw data), normalized data, and indexes Network actiity, payloads, normalized data, and indexes Time series graphs (global iews and aggregates) Note: Do not moe /transient or /storetmp to an offboard storage deice. Moing these directories causes your system to stop functioning properly. Performance impact of offboard storage solutions Moing the /store file system to an external deice might affect QRadar performance. After the migration, all data I/O to the /store file system is no longer performed on the local disk. Before you moe your QRadar data to an external storage deice you must consider the following information: Maintain your log and network actiity searches on your local disk by mounting the /store/transient file system to the unused /store file partition. Searches that are marked as saed are also in the /store/transient directory. If you experience a local disk failure, these searches are not saed. 2 IBM QRadar Security Intelligence: Offboard Storage Guide

9 Storage expansion By creating multiple olumes and mounting /store/ariel/eents and /store/ariel/flows, you can expand your storage capabilities past the single file system that is configured by default with QRadar. A single file system supports up to 500 TB. Any subdirectory in the /store file system can be used as a mount point for your external storage deice. Howeer, only the /store and /store/ariel file systems are supported for offboard with a high-aailability deployment. If you want to moe dedicated eent or flow data, you might configure more specific mount points. For example, you can configure /store/ariel/eents/records and /store/ariel/eents/payloads as mount points. External storage options You can use iscsi, Fibre Channel, or NFS to proide an offboard storage solution. Onboard disks proide a faster solution than offboard storage deices. Local disk storage on appliances supports IBM Security QRadar read speeds of MBps and write speeds of almost 200 Mbps. When multiple appliances are deployed, performance and capacity scale at the same rate. Fibre Channel Fibre Channel proides the fastest offboard performance by using storage area network (SAN) speeds of 200 MBps to 3200 MBps, depending on your network configuration. iscsi NFS Fibre Channel performance might be impacted by factors within the SAN implementation, such as the following factors: Disk or spindle counts per olume Number of concurrent sessions Cache capacity in the SAN controllers iscsi uses a dedicated storage channel oer standard Ethernet infrastructure, rather than a dedicated SAN network. For this reason, iscsi can be the easiest to implement, most cost effectie, and most readily aailable. If you implement an iscsi solution, then network capacity is shared between external storage access and management interface I/O. In this situation, you can configure a secondary network interface on a separate storage network. Using a dedicated interface, you are limited to 1 Gbps and might experience only 200 MBps to 400 MBps. Your iscsi storage deice might proide only 25 MBps to 50 MBps I/O performance. A Network File System (NFS) solution must not be used to store actie QRadar data. You can moe the /store/backup file system to an external NFS. If the /store file system is mounted to an NFS solution, PostgreSQL data can be corrupted. If the /store/ariel file system is mounted to NFS, QRadar experiences performance issues. Use NFS for tasks during off-peak times, tasks that inole batch file writes, and tasks that inole a limited olume of file I/O. For example, use NFS for daily configuration and data backups. NFS storage operates oer existing management Ethernet networks and is limited to performance leels of 20 MBps to 50 MBps. The NFS protocol might affect performance for file access, locking, and network permissions. Remediate the performance impact by using a dedicated network interface. 1 Oeriew 3

10 If NFS is used only for backups, the same NFS share can be used for each host. The backup files contain the system host name, which enables the identification of each backup file. If you are storing a long period of data on your NFS shares, consider a separate share or export for each appliance in your deployment. External storage limitations Multiple systems cannot access the same block deice in an IBM Security QRadar deployment. If you configure iscsi in an HA enironment, do not mount the iscsi or Fibre Channel olumes on the secondary host while the primary host is accessing the olumes. An external storage deice must be able to proide consistent read and write capacity of 100 MBps to 200 MBps. When consistent read and write capacity is not aailable, the following issues might occur: Data write performance is impacted. Search performance is impacted. If performance continues to degrade, then the processing pipeline can become blocked and QRadar might display warning messages and drop eents and flows. Offboard storage in HA enironments If you choose to moe the /store file system in a high-aailability (HA) enironment, the /store file system is not replicated by using Disk Replication Block Deice. If you moe the /store/ariel file system to an offboard storage deice and maintain the /store file system on local disk, the /store file system is synchronized with the secondary HA host. By default, when your enironment is configured for HA, Disk Replication Block Deice is enabled. If you are using HA and you moe a file system other than /store or /store/ariel to a multipath offboard storage solution, you must stop multipathd before upgrading QRadar. 4 IBM QRadar Security Intelligence: Offboard Storage Guide

11 2 iscsi external storage deice You can configure an iscsi storage deice in a standard or high-aailability (HA) IBM Security QRadar deployment. When you configure an iscsi external storage deice, you must migrate the QRadar data that is maintained on your /store or /store/ariel file system and then mount the /store or /store/ariel file system to a partition on the iscsi deice olume. Depending on your deice configuration, you might be required to create a partition on the olume of your iscsi disk. If you configure iscsi in an HA deployment and your primary HA host fails, your iscsi deice can be used to maintain data consistency with your secondary HA host. In HA enironments, reiew the /ar/log/messages file for errors in your iscsi storage configuration. iscsi configuration in standard QRadar deployments To moe data from a QRadar Console or managed host to an iscsi storage deice: Follow the instructions in Configure iscsi olumes. Migrate the file system to an iscsi storage deice. Moe the /store/ariel file system to an iscsi storage solution. Moe the /store file system to an iscsi storage solution. Follow the instructions in Mount the iscsi olume automatically. Follow the instructions in Verify iscsi connections. iscsi configuration in HA deployments To moe data in an HA deployment to an iscsi storage deice: Follow the instructions in Configure iscsi olumes on your primary appliance. Migrate the file system from your primary appliance to an iscsi storage deice. Moe the /store/ariel file system to an iscsi storage solution. Moe the /store file system to an iscsi storage solution. Follow the instructions in Mount the iscsi olume automatically on your primary appliance. Follow the instructions in Configuring iscsi in an HA deployment on page 10 on your secondary appliance. Follow the instructions in Verify iscsi connections. Configuring the iscsi olumes You can configure iscsi for a stand-alone QRadar Console or a QRadar Console that is the primary high-aailability (HA) host in an HA deployment. About this task You can also create a partition on the olume of the external iscsi storage deice. Copyright IBM Corp. 2012,

12 IBM Security QRadar V7.2.1 and later uses the XFS file system. You can create the partition on your iscsi deice with either an ext4 or XFS file system. Disk partitions are created by using a GUID Partition Table (GPT). You can use a new deice partition as the mount point for the file system, such as /store or /store/ariel that you migrate. Important: If you created an iscsi or Fibre Channel deice partition on your external deice and QRadar data is stored, then you cannot create a partition or reformat the partition on the olume. Procedure 1. Using SSH, log in to the QRadar Console as the root user. 2. Edit the /etc/iscsi/initiatorname.iscsi file to include the iscsi qualified name for your host. InitiatorName=iqn.<yyyy-mm>.{<reersed_domain_name>}:<hostname> Note: InitiatorName=iqn com.example:pl13 3. Open a session to the iscsi serer by typing the following command: systemctl restart iscsi 4. To detect olumes on the iscsi serer, type the following command: iscsiadm -m discoery --type sendtargets --<IP_address>:<port> The <IP_address> is the IP address of the iscsi serer. The <port> is optional. Record the initiator name. 5. To log in to the ISCSI serer, type the following command: iscsiadm -m node --targetname <initiator_name> --portal <IP_address>:<port> --login 6. To find the iscsi deice olume name, type the following command: dmesg grep Attached SCSI disk 7. Optional: To create a partition, use the GNU parted command: parted /de/<olume> a. Configure the partition label to use GPT by typing the following command: mklabel gpt b. If the following message is displayed, type Yes. Warning: The existing disk label on /de/olume will be destroyed and all data on this disk will be lost. Do you want to continue? c. To create the partition, type the following command: mkpart primary 0% 100% d. Set the default units to TB by typing the following command: unit TB e. Verify that the partition is created by typing the following command: print f. Exit from GNU parted by typing the following command: quit g. Update the kernel with the new partition data by typing the following command: partprobe /de/<olume> After you update the kernel, you might be prompted to restart the appliance. If you are prompted to do so, restart the appliance. h. To erify that the partition is created, type the following command: cat /proc/partitions i. Reformat the partition and make a file system. To create an XFS file system, type the following command: 6 IBM QRadar Security Intelligence: Offboard Storage Guide

13 mkfs.xfs -f /de/<partition> For an ext4 files system, type the following command: mkfs.ext4 /de/<partition> What to do next See Moing the /store/ariel file system to an iscsi storage solution on page 8 or Moing the /store file system to an iscsi storage solution. Related tasks: Troubleshooting iscsi issues on page 12 To preent iscsi disk and communication issues, you must connect QRadar, the iscsi serer, and your network switches to an uninterruptible power supply (UPS). Power failure in a network switch might result in your iscsi olume reporting disk errors or remaining in a read-only state. Moing the /store file system to an iscsi storage solution You can migrate the IBM Security QRadar data that is maintained in the /store file system and mount the /store file system to an iscsi deice partition. Migrating the /store files system to your offboard storage deice can take an extended time. Before you begin Configure iscsi olumes. Procedure 1. Stop the QRadar serices by typing the following commands in the order specified: systemctl stop hostcontext systemctl stop ecs-ec-ingress systemctl stop tomcat systemctl stop hostserices systemctl stop systemstabmon systemctl stop crond Note: Run the command systemctl stop tomcat on the Console. 2. Unmount the file systems by typing the following commands: umount /store 3. Create the /store_old directory by typing the following command: mkdir /store_old 4. Derie the iscsi deice partition uniersal unique identifier (UUID) by typing the following command: blkid /de/<partition> 5. Edit the /etc/fstab file to update the existing /store file system mount point to /store_old. 6. Make a new mount point for the /store file system by adding the following text to the /etc/fstab file: If the file system is XFS, add the following text: UUID=<uuid> /store xfs inode64,logbsize=256k,noatime,noauto,nobarrier 0 0 If the file system is ext4, add the following text: UUID=<uuid> /store ext4 noatime,noauto,nobarrier 0 0 Sae and close the file. 7. Mount the /store file system to the iscsi deice partition by typing the following command: 2 iscsi external storage deice 7

14 mount /store 8. Mount the /store_old file system to the local disk by typing the following command: mount /store_old 9. Moe the data from the local disk to the iscsi storage deice by typing the following command: cp -af /store_old/* /store 10. Unmount /store_old by typing the following command: umount /store_old 11. Remoe the /store_old directory by typing the following command: rmdir /store_old 12. Edit the /etc/fstab file to remoe the /store_old entry. 13. Start the QRadar serices by typing the following commands in the order specified: systemctl start crond systemctl start systemstabmon systemctl start hostserices systemctl start tomcat systemctl start ecs-ec-ingress systemctl start hostcontext 14. Remoe the local copy of /store from the logical olume manager (LVM) by typing the following commands: lchange -an /de/storerhel/store 2>/de/null lremoe /de/storerhel/store 2>/de/null What to do next See Mounting the iscsi olume automatically on page 9. Related tasks: Moing the /store/ariel file system to an iscsi storage solution You can migrate the IBM Security QRadar data that is maintained in the /store/ariel file system and mount the /store/ariel file system to an iscsi deice partition. Moing the /store/ariel file system to an iscsi storage solution You can migrate the IBM Security QRadar data that is maintained in the /store/ariel file system and mount the /store/ariel file system to an iscsi deice partition. Before you begin Configure iscsi olumes. Procedure 1. Stop the QRadar serices by typing the following commands in the order specified: systemctl stop hostcontext systemctl stop ecs-ec-ingress systemctl stop tomcat systemctl stop hostserices systemctl stop systemstabmon systemctl stop crond 2. Moe the existing mount point by typing the following commands: cd /store m ariel ariel_old 3. Verify the Uniersally Unique Identifier (UUID) of the iscsi deice partition by typing the following command: blkid /de/partition 8 IBM QRadar Security Intelligence: Offboard Storage Guide

15 4. Add the mount point for the /store/ariel file system by adding the following text to the /etc/fstab file: If the file system is XFS, copy the following text into a text editor, remoe the line break, and paste as a single line: UUID=uuid /store/ariel xfs inode64,logbsize=256k,noatime, noauto,nobarrier 0 0 If the file system is ext4, add the following text UUID=uuid /store/ariel ext4 noatime,noauto,nobarrier Create the ariel directory for the mount point by typing the following command: mkdir /store/ariel 6. Mount /store/ariel to the iscsi deice partition by typing the following command: mount /store/ariel 7. Verify that /store/ariel is correctly mounted by typing the following command: df -h 8. Moe the data from the local disk to the iscsi storage deice by typing the following command: cp -af /store/ariel_old/* /store/ariel 9. Remoe the /store/ariel_old directory by typing the following command: rmdir /store/ariel_old 10. Start the QRadar serices by typing the following commands in the order specified: systemctl start crond systemctl start systemstabmon systemctl start hostserices systemctl start tomcat systemctl start ecs-ec-ingress systemctl start hostcontext What to do next See Mounting the iscsi olume automatically. Related tasks: Moing the /store file system to an iscsi storage solution on page 7 You can migrate the IBM Security QRadar data that is maintained in the /store file system and mount the /store file system to an iscsi deice partition. Mounting the iscsi olume automatically You must configure IBM Security QRadar to automatically mount the iscsi olume. Before you begin Ensure that you moed the /store/ariel or /store file systems to an iscsi storage solution. Procedure 1. Add the iscsi script to the startup information by typing the following commands: systemctl enable iscsi 2. Enable the iscsi-mount serice by typing the following command: systemctl enable iscsi-mount 3. Verify that the iscsi deice is correctly mounted by typing the following command: df -h 2 iscsi external storage deice 9

16 What to do next If you are configuring iscsi in a standard QRadar deployment, see Verifying iscsi connections on page 11. If you are configuring a high-aailability (HA) enironment, you must set up your secondary HA host by using the same iscsi connections that you used for your primary HA host. For more information, see Configuring iscsi in an HA deployment. Related tasks: Configuring iscsi in an HA deployment To use an iscsi deice in an HA enironment, you must configure the primary and secondary HA hosts to use the same iscsi external storage deice. Configuring iscsi in an HA deployment To use an iscsi deice in an HA enironment, you must configure the primary and secondary HA hosts to use the same iscsi external storage deice. About this task Ensure that you use a different initiatorname on the primary and secondary HA hosts. Your iscsi deice must be configured to enable each initiatorname to access the same olume on the iscsi deice. Procedure 1. Use SSH to log in to the secondary HA host as the root user. 2. To configure your HA secondary host to identify the iscsi deice olume, add the iscsi qualified name for your host to the /etc/iscsi/initiatorname.iscsi file. Initiatorname=iqn.yyyy-mm.{reersed domain name}:hostname Note: The initiatorname for your secondary HA host must be different than the initiatorname for your primary HA host. Example: InitiatorName=iqn com.qradar:pl14 3. Restart the iscsi serice to open a session to the serer by typing the following command: systemctl restart iscsi 4. To detect the olume on the iscsi serer, type the following command: iscsiadm -m discoery --type sendtargets --portal IP address:[port] Note: The port is optional. 5. Verify the login to your iscsi serer by typing the following command: iscsiadm -m node --targetname <initiator_name_from_the_preious_step> --portal <IP_address: [port]> -- login 6. To find the iscsi deice olume name, type the following command: dmesg grep Attached SCSI disk 7. Optional: To create a partition, use the GNU parted command: parted /de/olume For more information about partitions, see Configuring the iscsi olumes on page Configure the mount point for the secondary HA host. a. If you are moing the /store file system, unmount the file systems by typing the following commands: umount /store 10 IBM QRadar Security Intelligence: Offboard Storage Guide

17 b. Identify the UUID of the iscsi deice partition by typing the following command: blkid /de/partition c. If you are moing the /store file system, edit the file settings in the /etc/fstab file to be the same as the mount points that might be listed in the /etc/fstab file on the HA primary host: /store For the /store partition, use the same UUID alue used for the /store partition on the primary. d. If you are moing the /store/ariel file system, edit the settings in the /etc/fstab file to be the same as the mount point that is listed in the /etc/fstab file on the HA primary host for /store/ariel. 9. Configure the secondary HA host to automatically mount the iscsi olume. a. Add the iscsi script to the startup information by typing the following commands: systemctl enable iscsi b. Enable the iscsi-mount serice by typing the following command: systemctl enable iscsi-mount c. If you are moing the /store file system, remoe the local copy of /store by typing the following commands: lchange -an /de/storerhel/store 2>/de/null lremoe /de/storerhel/store 2>/de/null What to do next See Verifying iscsi connections. Verifying iscsi connections Verify that the connections between a primary HA host or secondary HA host and an iscsi deice are operational Procedure 1. Using SSH, log in to the primary or secondary HA host as the root user. 2. To test the connection to your iscsi storage deice, type the following command: ping iscsi_storage_ip_address 3. Verify the iscsi serice is running and that the iscsi port is aailable by typing the following command: telnet iscsi_storage_ip_address 3260 Note: The default port is Verify that the connection to the iscsi deice is operational by typing the following command: iscsiadm -m node To erify that the iscsi deice is correctly configured, you must ensure that the output that is displayed for the primary HA host matches the output that is displayed for the secondary HA host. If the connection to your iscsi olume is not operational, the following message is displayed: iscsiadm: No records found 5. If the connection to your iscsi olume is not operational, then reiew the following troubleshooting options: Verify that the external iscsi storage deice is operational. Access and reiew the /ar/log/messages file for specific errors with your iscsi storage configuration. Ensure that the iscsi initiatornames alues are correctly configured by using the /etc/iscsi/inititatorname.iscsi file. 2 iscsi external storage deice 11

18 If you cannot locate errors in the error log, and your iscsi connections remain disabled, then contact your Network Administrator to confirm that your iscsi serer is functional or to identify network configuration changes. If your network configuration has changed, you must reconfigure your iscsi connections. What to do next Establish an HA cluster. You must connect your primary HA host with your secondary HA host by using the QRadar user interface. For more information about creating an HA cluster, see the IBM Security QRadar High Aailability Guide. Troubleshooting iscsi issues To preent iscsi disk and communication issues, you must connect QRadar, the iscsi serer, and your network switches to an uninterruptible power supply (UPS). Power failure in a network switch might result in your iscsi olume reporting disk errors or remaining in a read-only state. About this task In a high-aailability (HA) enironment, if your primary host fails, you must restore your iscsi configuration to the primary host. In this situation, the /store or /store/ariel data is already migrated to the iscsi shared external storage deice. Therefore, to restore the primary host iscsi configuration, ensure that you configure a secondary HA host. For more information, see Configuring iscsi in an HA deployment on page 10 Procedure 1. Determine whether a disk error exists. a. Using SSH, log in to QRadar Console as the root user. b. Create an empty file filename.txt on your iscsi olume by typing one of the following command: touch /store/ariel/filename.txt touch /store/filename.txt If your iscsi olume is mounted correctly and you hae write permissions to the olume, the touch command creates an empty file that is named filename.txt on your iscsi olume. If you see an error message, unmount and remount the iscsi olume. 2. Stop the QRadar serices. If you migrated the /store file system, type the following commands in the specified order: systemctl stop hostcontext systemctl stop ecs-ec-ingress systemctl stop tomcat systemctl stop hostserices systemctl stop systemstabmon systemctl stop crond If you migrated the /store/ariel file system, type the following command: systemctl stop hostcontext 3. Unmount the iscsi olume. If you migrated the /store file system, type the following commands: umount /store If you migrated the /store/ariel file system, type the following command: umount /store/ariel 4. Mount the iscsi olume. If you migrated the /store file system, type the following commands: 12 IBM QRadar Security Intelligence: Offboard Storage Guide

19 mount /store If you migrated the /store/ariel file system, type the following command: mount /store/ariel 5. Test the mount points. If you migrated the /store file system, type the following command: touch /store/filename.txt If you migrated the /store/ariel file system, type the following command: mount /store/ariel/filename.txt If you continue to receie a read-only error message after you remount the disk, then reconfigure your iscsi olume. Alternatiely, you can unmount the file system again and run a manual file system check with the following command: fsck /de/partition. 6. Start the QRadar serices. Related tasks: Configuring the iscsi olumes on page 5 You can configure iscsi for a stand-alone QRadar Console or a QRadar Console that is the primary high-aailability (HA) host in an HA deployment. Upgrading an HA deployment with an offboard iscsi /store partition Upgrade an IBM Security QRadar deployment with an iscsi /store offboard partition to QRadar V7.3.1 by performing the following procedure. Procedure 1. Remoe the HA pair. Note: For information about disconnecting an HA cluster, see the IBM Security QRadar High Aailability Guide. 2. Confirm that the order of the store mount points in the /etc/fstab file on the primary and the secondary hosts is as follows: a. /store b. /store/tmp c. /store/transient Restart the hosts if you made changes to the /etc/fstab file. 3. Mount the QRadar V7.3.1 ISO on the primary and secondary hosts by typing the following command: mount -o loop <Qradar_7.3.1.iso> /media/cdrom 4. Run the prepare upgrade scripts by typing the following command on the primary and secondary hosts: /media/cdrom/post/prepare_offboard_storage_upgrade.sh 5. Upgrade the primary host by typing the following command: /media/cdrom/setup 6. The upgrade fails after the initial restart. A message prompts you to remount the /store partition correctly. Refer to the original fstab information in the /storetmp/upgrade/original_fstab file to update the entry correctly in the /etc/fstab file. 7. Copy the /store line from /storetmp/upgrade/original_fstab, and then oerwrite the current /store line in /etc/fstab. 8. Add the initiator name on the primary host. 2 iscsi external storage deice 13

20 9. Restart iscsi by typing the following command: systemctl restart iscsi 10. Connect the iscsi serer. 11. Mount the /store partition on the external storage by typing the following command: mount /store 12. Continue the upgrade by typing the following command: /root/complete_upgrade.sh 13. After the upgrade on the primary host finishes, copy the following file from primary host to the detached offboard storage secondary host by typing the following command as one line: scp /opt/qradar/conf/capabilities/map_localhost_interfaces.txt.bak 14. Upgrade the detached offboard storage secondary host. 15. After the secondary upgrade finishes, complete the following steps on the secondary host: a. Ensure that the /store entry in the /etc/fstab file is identical on the primary and secondary hosts. b. Add the initiator name back to the secondary host. c. Restart iscsi by typing the following command: systemctl restart iscsi d. Connect the iscsi serer. e. Unmount the /store partition on the secondary host by typing the following command: umount /store 16. Reconnect the HA pair through the UI of the primary host. Upgrading an HA deployment with an offboard iscsi /store/ariel partition Upgrade an IBM Security QRadar deployment with an iscsi /store/ariel offboard partition to QRadar V7.3.1 by performing the following procedure. Procedure 1. Remoe the HA pair. Note: For information about disconnecting an HA cluster, see the IBM Security QRadar High Aailability Guide. 2. Confirm that the order of the mount points in the /etc/fstab file the primary and secondary hosts is as follows: a. /store b. /store/ariel c. /store/tmp d. /store/transient Restart the hosts if you made changes to the /etc/fstab file. 3. Ensure that the /store/ariel partition is mounted on the primary host and unmounted on the secondary host. 4. Mount the QRadar V7.3.1 ISO on the primary and secondary hosts by typing the following command: mount -o loop <Qradar_7.3.1.iso> /media/cdrom 5. Upgrade the primary host by typing the following command: /media/cdrom/setup 14 IBM QRadar Security Intelligence: Offboard Storage Guide

21 6. The upgrade fails after the initial restart. A message prompts you to remount the /store/ariel partition correctly. Refer to the original fstab information in the /storetmp/upgrade/original_fstab file to update the entry correctly in the /etc/fstab file. 7. Copy the /store/ariel line from /storetmp/upgrade/original_fstab, and then oerwrite the current /store/ariel line in /etc/fstab. 8. Add the initiator name back on the primary host. 9. Restart iscsi by typing the following command: systemctl restart iscsi 10. Connect the ISCSI serer. 11. Mount the /store/ariel partition by typing the following command: mount /store/ariel 12. Continue the upgrade by typing the following command: /root/complete_upgrade.sh 13. After the upgrade on the primary host finishes, copy the following file from the primary host to the detached offboard storage secondary host by typing the following command as one line: scp /opt/qradar/conf/capabilities/map_localhost_interfaces.txt.bak root@<secondary_ip>:/opt/qradar/ha/map_localhost_interfaces.txt 14. After the secondary upgrade finishes, complete the following steps on the secondary host: a. Ensure that the /store/ariel entry in the /etc/fstab file is identical on the primary and secondary hosts. b. Add the initiator name back to the secondary host. c. Restart iscsi by typing the following command: systemctl restart iscsi d. Connect the iscsi serer. 15. Reconnect the HA pair through the UI of the primary host. Secondary network interfaces You can configure a secondary network interface with a priate IP address to connect to an iscsi storage area network (SAN). You use secondary network interface to improe performance. If you configure a secondary network interface, you require address information from your SAN network manager. For more information about configuring a network interface, see Network interface management in the IBM Security QRadar Administration Guide. HA systems in iscsi deployments For dedicated access to the iscsi storage network, use the following order to set up high aailability (HA), iscsi, and a network interface: 1. Configure the primary and secondary appliances. 2. Set up external iscsi storage on both hosts. 3. Configure HA on the primary and secondary hosts. 4. Configure control of the secondary interfaces for your HA apliances. See Configuring control of secondary interfaces in HA deployments on page 16. The HA process for IBM Security QRadar controls the all network interfaces. When an HA appliance is in actie mode, the HA process enables the interfaces. When HA is in standby mode, the HA process disables the interfaces. If the dedicated network interface for storage is disabled and the HA system goes into failoer, the standby host tries to go into actie mode. If the HA system is in standby mode, you 2 iscsi external storage deice 15

22 cannot access the iscsi storage system. Access issues are caused during the transition of the HA node from standby to actie. The HA process brings the secondary interface online, but when the iscsi system is mounted, the networking is not aailable and the failoer process fails. The standby HA host cannot change to actie mode. To resole the issue, you must remoe control of the iscsi network interface from the HA system to ensure that network interface is always actie. Remoe any dependencies that the network interface has on the status of the HA node. The HA primary and secondary hosts must hae unique IP addresses on these secondary network interfaces. Related tasks: Configuring control of secondary interfaces in HA deployments If you use iscsi and a dedicated network interface in a high-aailability (HA) deployment, you must ensure that the secondary interface is not managed by the HA process. Configure the management of the secondary interface to ensure that in the eent of a failoer to the secondary HA host, the interface always remains actie. Configuring control of secondary interfaces in HA deployments If you use iscsi and a dedicated network interface in a high-aailability (HA) deployment, you must ensure that the secondary interface is not managed by the HA process. Configure the management of the secondary interface to ensure that in the eent of a failoer to the secondary HA host, the interface always remains actie. Before you begin Ensure that the following conditions are met: Separate IP addresses for the dedicated iscsi network interface on each of the HA serers Separate IP addresses preent IP address conflicts when the network interfaces are actie on both HA hosts at the same time. The iscsi software and driers can access the external storage at startup and during the HA failoer. Also, the external olume can be successfully mounted when the HA node switches from standby to actie. The primary and secondary appliances are configured. For more information, see the IBM Security QRadar High Aailability Guide. iscsi storage is configured. NetworkManager is disabled by typing the command systemctl status NetworkManager Procedure 1. On the primary host, use SSH to log in to the QRadar Console as the root user. 2. Disable the QRadar HA serice control of network interface. a. Go to the /opt/qradar/ha/interfaces/ directory The directory contains a list of files that are named ifcfg-ethn. One file exists for each interface that is controlled by QRadar HA processes. b. Delete the file that is used to access your ISCSI storage network. Deleting the file remoes control of the interface from the HA processes. 3. Re-enable operating system-leel control of the network interfaces. a. Go to the /etc/sysconfig/network-scripts/ifcfg-ethn directory. b. Open the ifcfg-ethn file for the interface that connects to your ISCSI network. c. To ensure that the network interface is always actie, change the alue for the ONBOOT parameter to ONBOOT=yes. 4. To restart the iscsi serices, type the following command: systemctl restart iscsi 16 IBM QRadar Security Intelligence: Offboard Storage Guide

23 5. Repeat these steps for the HA secondary appliance. 6. Optional: To test access to your iscsi storage from your secondary appliance, use the ping command: ping iscsi_serer_ip_address Related concepts: Secondary network interfaces on page 15 You can configure a secondary network interface with a priate IP address to connect to an iscsi storage area network (SAN). 2 iscsi external storage deice 17

24 18 IBM QRadar Security Intelligence: Offboard Storage Guide

25 3 Fibre Channel storage You can configure Fibre Channel (FC) in a standard QRadar deployment or in a high-aailability (HA) enironment. You can also configure FC multipath to proide redundancy if your FC switch fails. When you configure an FC deice, you can moe the IBM Security QRadar data in your /store or /store/ariel file system. Then, mount the /store or /store/ariel file system to a partition on the FC deice. Frequently searched data must be moed to a faster disk. For example, moe recent data or data that is used for security incident inestigations. Howeer, deploying high performance offboard disk storage might be costly. Where possible, use lower performance and less expensie offboard storage for actiities such as moing older data, archiing, or for reporting purposes. If you are using FC only for archie purposes, then use the same mount point for eery appliance and configure these mount points to correspond with each unique FC olume. In deployments that use multiple appliances, ensure that each appliance is configured to use a separate FC olume. Failure to use separate olumes can result in two deices that mount the same block deice, which can corrupt the block deice file system. Depending on your deice configuration, you might be required to create a partition on the olume of your FC disk. Configuring Fibre Channel (FC) is different for a primary high-aailability (HA) host than the secondary HA host. To configure FC, you must ensure that the primary HA host and secondary HA host are not connected in an HA cluster. Fibre Channel configuration in standard QRadar deployments To moe data from a QRadar Console or managed host to an FC storage deice: Follow the instructions in Verifying your Emulex adapter installation on page 20. Follow the instructions in Verifying the Fibre Channel connections on page 20. Migrate the file system to an FC deice: Moing the /store file system to a Fibre Channel solution on page 21. Moing the /store/ariel file system to a Fibre Channel solution on page 23. Multipath Fibre Channel configuration in standard QRadar deployments To moe data from a QRadar Console or managed host to multiple FC storage deices: Follow the instructions in Verifying your Emulex adapter installation on page 20. Follow the instructions in Verifying the Fibre Channel connections on page 20. Follow the instructions in Moing the /store file system to a multipath Fibre Channel solution on page 24. Fibre Channel configuration in HA deployments To moe data in an HA deployment to an FC storage deice: Follow the instructions in Verifying your Emulex adapter installation on page 20. Follow the instructions in Verifying the Fibre Channel connections on page 20. Copyright IBM Corp. 2012,

26 Migrate the file system to an FC deice: Moing the /store file system to a Fibre Channel solution on page 21. Moing the /store/ariel file system to a Fibre Channel solution on page 23 Follow the instructions in Configuring the mount point for the secondary HA host on page 26 on the secondary appliance. If you configure FC in an HA deployment and your primary HA host fails, your FC deice can be used to maintain data consistency with your secondary HA host. For more information about data consistency and shared storage in an HA enironment, see the IBM Security QRadar High Aailability Guide. Multipath Fibre Channel configuration in HA deployments To moe data in an HA deployment to multiple FC storage deices: Follow the instructions in Verifying your Emulex adapter installation. Follow the instructions in Verifying the Fibre Channel connections. Follow the instructions in Moing the /store file system to a multipath Fibre Channel solution in an HA deployment on page 25. Verifying your Emulex adapter installation You must erify that an Emulex LPe12002 Host Bus adapter is attached and installed with the correct firmware and drier ersions. Before you begin To use the Fibre Channel protocol, you must install an Emulex LPe12002 Host Bus adapter on your IBM Security QRadar appliance. In a high-aailability (HA) deployment, you must install an Emulex LPe12002 card on the primary and secondary HA host. The Emulex LPe Host Bus adapter must use the following drier and firmware ersions, or later: Drier ersion: p Firmware ersion: 1.10A5(U3D1.10A5), sli-3 Procedure 1. Using SSH, log in to your QRadar host as the root user: 2. Verify that an Emulex LPe12002 card is attached by typing the following command: hbacmd listhbas If no result is displayed, then contact your system administrator. 3. Verify that the Emulex card is using the correct firmware and drier ersions by typing the following command: hbacmd HBAAttrib <deice_id> deice id is the Port WWN that is displayed in the preceding step. Related tasks: Verifying the Fibre Channel connections You must identify the disk olume on the external Fibre Channel deice. If required, you must also create a partition on the olume. Verifying the Fibre Channel connections You must identify the disk olume on the external Fibre Channel deice. If required, you must also create a partition on the olume. 20 IBM QRadar Security Intelligence: Offboard Storage Guide